[170633] in North American Network Operators' Group
Re: BGPMON Alert Questions
daemon@ATHENA.MIT.EDU (Bryan Tong)
Wed Apr 2 16:41:13 2014
In-Reply-To: <94081c39f9a5d313228bb194643fe287.squirrel@66.201.44.180>
Date: Wed, 2 Apr 2014 14:21:29 -0600
From: Bryan Tong <contact@nullivex.com>
To: bob@fiberinternetcenter.com
Cc: "nanog@nanog.org" <nanog@nanog.org>
Errors-To: nanog-bounces+nanog.discuss=bloom-picayune.mit.edu@nanog.org
They have advertised all of ours now.
On Wed, Apr 2, 2014 at 2:16 PM, Bob Evans <bob@fiberinternetcenter.com>wrote:
> Yes, I too have alerts for some of our prefixes from the same offending
> origin 4761
>
> On Wednesday April 2nd 2014 at 19:59 UTC we detected a Origin AS Change
> event for your prefix (66.201.48.0/20 slash 20 bottom of nor cal)
> The detected prefix: 66.201.48.0/20, was announced by AS4761
> (INDOSAT-INP-AP INDOSAT Internet Network Provider,ID)
> Alert description: Origin AS Change
> Detected Prefix: 66.201.48.0/20
> Detected Origin AS: 4761
> Expected Origin AS: 26803
>
> Bob Evans
> CTO
>
>
>
>
> > So I setup BGPMON for my prefixes and got an alert about someone in
> > Thailand announcing my prefix. Everything looks fine to me and I've
> > checked a bunch of different Looking Glasses and everything announcing
> > correctly.
> >
> > I am assuming I should be contacting the provider about their
> > misconfiguration and announcing my prefixes and get them to fix it. Any
> > other recommendations?
> >
> > Is there a way I can verify what they are announcing just to make sure
> > they
> > are still doing it?
> >
> > Here is the alert for reference:
> >
> > Your prefix: 8.37.93.0/24:
> >
> > Update time: 2014-04-02 18:26 (UTC)
> >
> > Detected by #peers: 2
> >
> > Detected prefix: 8.37.93.0/24
> >
> > Announced by: AS4761 (INDOSAT-INP-AP INDOSAT Internet Network
> > Provider,ID)
> >
> > Upstream AS: AS4651 (THAI-GATEWAY The Communications Authority
> of
> > Thailand(CAT),TH)
> >
> > ASpath: 18356 9931 4651 4761
> >
>
>
>
>
--
eSited LLC
(701) 390-9638
